Cybersecurity8 June 2026· 5 min read· Nagy Rudolf

How to Create a Password That Actually Resists Cracking

P@ssw0rd! satisfies every complexity rule and falls in under a second. Here is what actually makes a password hard to break.

Password rules taught in the 2000s — one capital, one number, one symbol — were designed for humans guessing, not for GPUs. Attackers do not guess; they run wordlists and substitution rules against leaked hashes at billions of attempts per second.

What makes a password hard

Entropy: the number of possibilities an attacker must try. Entropy comes from length and unpredictability, not from decoration. A 16-character random string from a 90-character alphabet has around 104 bits of entropy and is out of reach. P@ssw0rd! has almost none, because every substitution it uses is in every cracking ruleset.

Two workable strategies

Generated random strings. Use the password generator — it draws from the browser's cryptographic random source, not Math.random() — set 16+ characters, and store the result in a password manager. You never type it, so its unreadability is irrelevant.

Passphrases. Four or five random words — copper-hinge-marble-yodel — give strong entropy and remain typeable. This is the right choice for the handful of passwords you must memorise: the device login and the password manager's master password.

The rules that matter more than composition

  1. Never reuse. Credential stuffing — replaying a leaked pair against other sites — is the most common account takeover by a wide margin.
  2. Turn on two-factor authentication. An app-based code or a hardware key defeats a stolen password. SMS is weak but far better than nothing.
  3. Protect email first. Every other account resets through it.
  4. Change on breach, not on schedule. Forced rotation produces Summer2026!Autumn2026!. Change when there is a reason.

Storage

A password manager is the enabling technology for all of the above; without one, reuse is inevitable. Its master password should be a long passphrase, and its recovery kit should be printed and kept offline.

Generating safely

Generation must happen locally. A password produced by a server has been transmitted, logged perhaps, and is no longer exclusively yours. The Data Wave Cloud generator runs entirely in the browser and shows a live strength estimate so you can see what each extra character buys.

FAQ

How long should a password be? 16 characters generated, or 4–5 random words as a passphrase.

Are symbols required? Helpful but secondary — length contributes far more entropy.

Is a browser's built-in manager good enough? Yes for most people, provided the account itself has two-factor authentication.

Keep reading